4.1. Procedure – Configuring Server Name Indication (SNI)

Purpose: 

To configure an HttpProxy in a name-based virtual hosting scenario that uses Server Name Indication (SNI) to determine the address of the target server, complete the following steps.

Steps: 

1. Create and configure an Encryption Policy. Complete the following steps.

   1. Navigate to the Application-level Gateway MC component of the firewall host.

   2. Select Policies > New.

   3. Enter a name into the Policy name field, for example, MySNIEncryption.

   4. Select Policy type > Encryption Policy, then click OK.

      

      Figure 8. Creating an Encryption policy

   5. Select Class > TwoSidedEncryption.

      

      Figure 9. Configuring the Encryption policy

      Python:

      EncryptionPolicy(
          name="MySNIEncryption",
          encryption=TwoSidedEncryption()
          )

2. Double-click client_certificate_generator, then select Class > SNIBasedCertificate.

   

   Figure 10. Configuring the certificate

3. Double-click default, then select the default certificate. Application-level Gateway will show this certificate to the clients when none of the other configured certificates match the client request.

   Python:

       encryption=TwoSidedEncryption(
           client_certificate_generator=SNIBasedCertificate(
               default=StaticCertificate(
                   certificate=Certificate.fromFile(
                       certificate_file_path="/etc/key.d/MS_Engine/cert.pem",
                       private_key=PrivateKey.fromFile(
                           "/etc/key.d/MS_Engine/key.pem"))
               )
           )
       )

4. Configure a mapping that describes which certificate belongs to which hostname. For each certificate, configure a Matcher Policy. If this policy matches the domain name in the client SNI request, Application-level Gateway shows the associated certificate to the client. You can use any type of matcher policy here, but in most scenarios you will need only RegexpMatcher policies. (For details on Matcher Policies, see Section 6.7.4, Matcher policies in Proxedo Network Security Suite 1.0 Administrator Guide.)

   The following example configures two matchers and two certificates, one for the myfirstdomain.example.com domain, one for the myseconddomain.example.com domain. Complete the following steps:

   1. Double-click hostname_certificate_map, then click New.

   2. Select Class > RegexpMatcher.

   3. Click Match > New, then enter the domain name (for example, myfirstdomain.example.com) into the Expression field. Click OK.

      

      Figure 11. Configuring the hostname-certificate mapping

   4. Click Edit > certificate_file_path, then select the certificate to show if a client tries to access the domain set in the previous step.

      

      Figure 12. Configuring the hostname-certificate mapping

   5. Click Select, then click OK.

   6. Repeat Steps a-e for the myseconddomain.example.com domain and its respective certificate.

   Python:

       encryption=TwoSidedEncryption(
           client_certificate_generator=SNIBasedCertificate(
               default=StaticCertificate(
                   certificate=Certificate.fromFile(
                       certificate_file_path="/etc/key.d/MS_Engine/cert.pem",
                       private_key=PrivateKey.fromFile(
                           "/etc/key.d/MS_Engine/key.pem"))
               )
               hostname_certificate_map={
                   RegexpMatcher(
                       match_list=("myfirstdomain.example.com", )): StaticCertificate(
                           certificate=Certificate.fromFile(
                               certificate_file_path="/etc/key.d/myfirstdomain/cert.pem",
                               private_key=PrivateKey.fromFile(
                                   "/etc/key.d/myfirstdomain/key.pem"))),
                   RegexpMatcher(
                       match_list=("myseconddomain.example.com", )): StaticCertificate(
                           certificate=Certificate.fromFile(
                               certificate_file_path="/etc/key.d/myseconddomain/cert.pem",
                               private_key=PrivateKey.fromFile(
                                   "/etc/key.d/myseconddomain/key.pem")))
                   },
           )
       )

5. Configure the other options of the Encryption Policy as needed for your environment.

6. Create a service and a firewall rule that uses this new Encryption Policy and an HttpProxy class.

   Python:

   def demo() :
       Service(
           name='demo/inter_HttpSNIService',
           router=TransparentRouter(),
           chainer=ConnectChainer(),
           proxy_class=HttpProxy,
           max_instances=0,
           max_sessions=0,
           keepalive=Z_KEEPALIVE_NONE,
           encryption_policy="MySNIEncryption"
       )
   
       Rule(
           rule_id=300,
           src_subnet=('internet', ),
           dst_zone=('dmz', ),
           proto=6,
           service='demo/inter_HttpSNIService'
       )